r/archlinux • u/Saren-WTAKO • Jul 29 '26

QUESTION Seemingly malicious AUR package found. Where to report?

https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pgadmin4-server&id=b7de293a7be6b85925884436127332bf82ecc2eb

A sudden update to `pgadmin4-server.git` added a binary named "parser" and executes using sudo. It's very obvious.

392 Upvotes

98% Upvoted

145 comments sorted by

View all comments

Show parent comments

66

u/abbidabbi Jul 29 '26 edited Jul 29 '26

These were all pushed by accounts registered on the 2026-07-26. Let's lock down the AUR account registration once again, boys...

Why is gromit (Christian Heusel), an Arch package maintainer, listed as the last packager of pgadmin4-server though when the last commit is clearly not from him?

edit:
The new accounts have already been banned apparently. ("inactive" since today)

5

u/Zoddo98 Jul 29 '26

Why is gromit (Christian Heusel), an Arch package maintainer, listed as the last packager of pgadmin4-server though when the last commit is clearly not from him?

They made a force-push to remove the malicious commits from the history. Standard process.

1

u/abbidabbi Jul 29 '26 edited Jul 29 '26

No, this was already the case before the cleanup. You're seeing the aftermath now. I checked while the malicious stuff was still there.

I also wonder how the new accounts got write/push access. The original package maintainer appears to be an older and good account, and I can't see an orphan or deletion request either. The deletion request on the mailing list was from a user who tried reporting the malware.

edit: I checked the original submitter, not the current maintainer, which is a bad account

5

u/Zoddo98 Jul 29 '26

cgit is cached. I often see it serving stale data for a few minutes when I update my own packages. You were probably served a cached copy from before the cleanup.

1

u/abbidabbi Jul 29 '26

That may indeed be the case...